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Response to ICO consultation: Data protection and journalism code of practice 


About IPSO 


The Independent Press Standards Organisation (IPSO) is the independent regulator of most of 
the UK’s newspaper and magazine industry. We regulate over 1,500 print titles and 1,100 
online titles, comprising 95% of national daily newspapers (by circulation) and the majority of 
local and regional newspapers. 


We provide independent and effective regulation for a free and responsible press. We 
promote high quality journalism by enforcing editorial standards; holding publications to 
account; protecting the rights of individuals; and helping to maintain freedom of expression. 


IPSO’s framework is one of voluntary self-regulation underpinned by legally enforceable 
contractual agreements. It is not obligatory for publishers to join IPSO but those that have 
done so set themselves apart by choosing to be independently regulated and held 
accountable to an agreed set of standards, the Editors’ Code of Practice. ' 


About our response 


IPSO welcomes ICO’s call for views on data protection and journalism code of practice. 


Journalism requires adherence to criminal and civil law as well as regulatory obligations. 
Many journalists produce content for use across multiple channels, for myriad platforms 
including print, online, audio-visual channels, plus the BBC or other public service 
broadcasters. In effect, they must consider their obligations under Ofcom's Code, the Editors’ 
Code, as well as legal matters enshrined in the Data Protection Act (2018) (DPA) and other 
legislation. 


Accessible, practical guidance that journalists can refer to is much-needed and useful. 
Journalists and editors often face challenging decisions and there are times when a balance 
must be struck, particularly between an individual’s privacy and rights over personal data, the 
public’s right to know, and what is genuinely in the public interest. 


Journalists collect, use and store various forms of personal data in the course of their 
legitimate journalistic activities. When journalists and editors adhere to the Editors’ Code, they 
are already in a good position in regards to compliance with their obligations under the DPA 
(2018). 


1 https://www.ipso.co.uk/editors-code-of-practice/ [accessed 24 May 2019] 


ICO’s questions 


Q1 We are considering using our current guidance “Data protection and journalism: a guide 
for the media” as the basis on which we will build the new journalism code. Do you agree or 
disagree with this approach? 


IPSO sees no reason why this would not be a good approach. 


Q3 “Data protection and journalism: a guide for the media” is split into three sections...Do 
you think we should retain this structure for the code? 


IPSO sees no reason why this this structure should be changed. 


Q5 Do you think ICO’s existing guidance for journalists addresses the main areas where data 
protection issues commonly arise? 


Yes, but please see further comments below. 
Q6 If no, what additional areas would you like to see covered? 


The existing ICO guidance covers the main areas where data protection issues commonly 
arise in relation to the media. You may also wish to consider the availability of personal data 
in relation to social media. 


Increased availability of individuals’ personal data via the internet poses opportunities for 
journalists to identify stories, gather evidence and reach out to potential interviewees. The 
same considerations should be taken when handling this particular type of personal data as 
any other form of personal data. There is sometimes confusion in this area which any new 
guidance from ICO may wish to address specifically. 


In an attempt to provide clarity on the use of information taken from social media, IPSO 

produced publicly available Social Media guidance. It provides a framework for thinking 

through questions about using this material, and some examples of relevant decisions by 
IPSO’s Complaints Committee. 


The IPSO guidance asks journalists to consider issues relating to privacy and harm caused to 
individuals, including to what extent the material is already in the public domain, who has 
placed it there, and whether there are any privacy settings. It asks journalists to think about 
the nature of the material before publication. 


We suggest that ICO might consider making reference to use of personal data from social 
media in their future guidance, if it is felt that there may be an area that further practical 
advice could be useful for journalists. 


QZ The journalism code will address changes in data protection law, including developments 
in relevant case law. Are there any particular changes to data protection law that you think we 
should focus on in the code? 


No. However, we would encourage the journalism code and resulting guidance to make 
reference to IPSO’s rulings and our own guidance which regularly deal with the use of 
personal data within a regulatory (rather than legal) context. 


Q8 Apart from recent changes fo data protection law, are there any other developments that 
are having an impact on journalism that you think we should address in the code? 


The guidance should make reference to IPSO Complaints Committee rulings, and direct 
journalists towards the appropriate web page website accordingly.” The rulings on Clause 2 
(Privacy) will be particularly relevant to a journalist’s understanding and interpretation of how 
privacy is dealt with under the Editors’ Code.’ 


There are a great many activities that are proscribed by both the law (civil and criminal) and 
the Editors’ Code. In some areas, the alignment between the Editors’ Code and the law is very 
close; in particular, the terms of Clause 2 (Privacy) were drafted specifically to echo the terms 
of the Human Rights Act 1998, with the aim of keeping the Editors’ Code and the law in 
accord. 


ICO’s “Data protection and journalism: a guide for the media” says the DPA (1998) is based 
around eight common-sense principles, which are flexible enough to accommodate most 
responsible day-to-day journalistic practices. It outlines how the DPA sets out a framework of 
rights and duties that are designed to balance an individual’s right to information privacy 
against the legitimate needs of others to collect and use people’s details. The Editors’ Code 
works very similarly in that there are few hard and fast rules. Rather, it balances both the 
rights of the individual and the public’s right to know, through sixteen clauses. 


For journalists whose work features in IPSO-regulated publications we would like to stress that 
our rulings on certain complaints could be of assistance to help understand how balances 
between opposing rights — especially in relation to privacy — have been interpreted by IPSO’s 
Complaints Committee. 


There have been changes within industry that may present challenges for journalists and 
media organisations; more freelance journalists working for numerous organisations, 
increasing re-publication of very similar content, smaller and more centralised newsrooms, 
increasing numbers of “take-down requests” around online articles, and growing numbers of 
hyper-local publishers. 


We would suggest that guidance on data protection responsibilities should be tailored to take 
into account developments in the structure of the media industry which may require explicit 
clarification. IPSO discussed some of these changes in our submission to the Cairncross 
Review. 4 


The first issue is that increasing numbers of journalists work in a freelance capacity. This 
means journalists’ content may feasibly be published across numerous media channels and 
by different media companies. As part of the practical guidance section, we would suggest 
further explanation and clarity on any conflicts that might potentially arise between an 
individual journalists’ obligations under data protection legislation and any larger media 
organisations’ obligations. This would help avoid confusion over various parties’ 


2 IPSO’s Complaints Committee Rulings and Resolutions can be found online, here: 
https://www.ipso.co.uk/rulings-and-resolution-statements/ [accessed 24 May 2019] 

3 See the Editors’ Codebook on privacy 
http://www.editorscode.org.uk/downloads/codebook/codebook-2018.pdf [accessed 24 May 2019]. 
4 IPSO’s submission to the Cairncross Review into sustainability of high-quality journalism, available 
here: https://www.ipso.co.uk/media/1570/ipso-submission-to-the-cairncross-review.pdf [accessed 23 
May 2019] 


responsibilities, and clarify good practice in relation to data storage and deletion of 
unnecessary personal data. 


IPSO provides training for journalists and editors of our member publications. A topic that is 
regularly brought up during training sessions is the increasing number of so-called “takedown 
requests” from subjects whose personal data features in online news articles. For example, we 
believe our member publications are being increasingly contacted with requests to remove 
articles covering the criminal courts. Many individuals with convictions request that news 
articles on their crimes are removed when the conviction becomes spent, arguing that storing 
and sharing this type of personal data is no longer appropriate. Such issues are further 
compounded by the industry’s increasing use of identical and similar stories across the media, 
which can cause confusion over responsibility for data protection issues. 


Similarly, we are aware of confusion amongst journalists on rules and responsibilities around 
online news archives where individuals’ personal data may be accessible and stored. We 
believe that clarity in guidance around data storage, responsibilities in relation to online news 
archives and takedown requests could be of use. 


IPSO regulates publications of different sizes; from the largest national tabloids to some very 
small, independent hyper-local publications. New and emerging publications would benefit 
from tailored guidance on their responsibilities. A hyper-local publication will lack the in- 
house expertise and availability of specialist legal advice around data protection which is 
available to those working within very large media organisations. 


Q? Are there any case studies or journalism scenarios that you would like to see included in 
the journalism code? 


We would like to stress the importance of case studies and real-life examples in helping 
journalists in circumstances where a balance should be struck between competing rights and 
responsibilities. Where legislation and regulatory rules are formed around abstract principles 
and competing rights as opposed to very clear and definable rules, these can help journalists 
interpret these principles in practice. 


Conclusion 


For further information ii contact Sophie Malleson, Policy and Public Affairs Officer at 


